Loading story…
Researchers reported a large-scale SEO poisoning campaign that hijacked abandoned cloud DNS delegations to publish Thai-language gambling pages on legitimate corporate subdomains belonging to 163 organizations in more than 30 countries. The activity primarily abused orphaned Azure DNS zones, though investigators also observed stale configurations involving DigitalOcean, wildcard misconfigurations, and a Verizon-linked cluster with more than 1,000 deceptive A records. Victims included government agencies, hospitals, banks, universities, and critical infrastructure providers, and 161 of the 163 organizations were still actively compromised when the findings were published.
The operators reclaimed forgotten DNS zones, added wildcard or bulk DNS records, obtained valid Let’s Encrypt wildcard certificates, and deployed a consistent Next.js gambling kit that made the pages appear trustworthy to users, browsers, and search engines. Investigators linked the infrastructure through shared favicons, redirect paths, certificates, JARM fingerprints, HTTP body hashes, and Chinese-language management artifacts, tracing delivery nodes and a 103-server backend network in Hong Kong that supported affiliate gambling domains and referral codes such as link99, ibiza99vip1, bigwinv1, and seven77vip1. The campaign relied on DNS hygiene failures rather than malware or application exploits, with server-side geographic filtering used to redirect Thai users to gambling destinations.
Get the infrastructure and lures behind it.
2 events from the most recent confirmed update back to the earliest known activity.
Analysis tied the SEO poisoning operation to a backend fleet of 103 servers in Hong Kong, using shared certificates, JARM fingerprints, HTTP body hashes, and other infrastructure overlaps. The backend supported affiliate-driven gambling domains and was assessed by one report as linked to a single Chinese operator.
Cyble researchers documented an active SEO poisoning campaign abusing abandoned cloud DNS delegations, primarily Azure DNS, to serve Thai-language gambling pages from trusted enterprise subdomains. The activity affected 163 organizations across more than 30 countries, with 161 still actively compromised at the time of reporting.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 30 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
5 references tracked. Mallory keeps watching after this page renders.
community.gurucul.com
Open sourcecysecurity.news
Open sourcemalware.news
Open sourcemalware.news
Open sourcecyble.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Check Point Research reported that the Chinese-speaking **Gambling Goblin** cybercrime cluster has compromised Brazilian government, educational, and commercial Linux web servers since mid-2025. The operators install malicious Apache modules that covertly reverse-proxy traffic from trusted victim domains to fake Google Play, Microsoft Store, and Amazon-branded gambling and betting pages, abusing the victims’ reputations to manipulate search-engine rankings at scale. The group uses an obfuscated Linux toolkit including DownPro, ChUser, PasswordHarvester, AlphaAgent, oRAT, an SSH brute-forcer, and reconnaissance utilities to steal credentials, maintain persistence, move laterally, and remotely administer compromised hosts. Researchers assess with medium-to-high confidence that Gambling Goblin is linked to **Earth Berberoka**, citing shared oRAT code, Chinese-language artifacts, gambling-focused operations, lookalike-domain techniques, and overlapping Amazon-hosted infrastructure; associated systems also host Vietnamese, Spanish, and English phishing content and generate domains daily, creating capacity to expand internationally or distribute malware.
Sep 8, 2026
Elastic Security Labs reported a **global SEO poisoning operation** compromising Windows **IIS** web servers using a malicious IIS module dubbed **BADIIS**, attributed to a Chinese-speaking cybercrime group tracked as **REF4033** and aligned with Cisco Talos’ **UAT-8099**. The activity observed in an intrusion at a multinational organization in Southeast Asia matches prior public reporting and is assessed to have impacted **1,800+ Windows servers** across multiple sectors (including government, corporate, and education) in countries spanning Asia-Pacific, Europe, and Latin America. The operation uses a two-phase workflow: serving keyword-stuffed content to search engine crawlers to manipulate rankings, then redirecting real users to monetization destinations in the “vice economy,” including **online gambling**, pornography, and cryptocurrency schemes. Additional research emphasized that multiple vendors are labeling overlapping slices of the same IIS SEO-fraud ecosystem differently, and recommended consolidating hunting for **UAT-8099/WEBJACK**-style activity based on shared indicators and behaviors. Defensive guidance focused on detecting **new/unknown IIS module registrations** and suspicious DLL/module naming and staging patterns (e.g., `fashttp/fasthttp/cgihttp/iis32/iis64`-style DLLs; staging under paths like `Desktop\VN`, `Desktop\newth`, `Public\Videos`), correlating anomalous local account creation patterns (e.g., **`$`-suffixed accounts**) and remote-access tooling on web servers, and using **HTTP differential-response probing** (varying `User-Agent`, `Referer`, `Accept-Language`) to identify cloaking behavior used to selectively serve crawler vs. user content.
Jun 29, 2026
Threat researchers identified three criminal ecosystems hiding behind visually similar casino and adult websites: Chinese-language illegal gambling and money-laundering operations, fraudulent “scambling” platforms, and decoy sites hosting **PeckBirdy** malware command-and-control (C2) infrastructure. The Chinese-language gambling ecosystem spans more than 1.7 million domains and includes the FUNNULL CDN, Vigorish Viper, and Sable Squirrel networks; Sable Squirrel alone reportedly controls roughly 10,000 drop-caught expired domains, has spent more than $7 million acquiring them, and has been linked to 405 C2 domains and more than 31,000 malware samples communicating with its infrastructure. China-aligned actors have used PeckBirdy since 2023, embedding JavaScript and WebSocket C2 services in low-quality casino and adult sites, including `cache-cdn[.]org`, `cache-mcp[.]com`, `mcp-source[.]online`, and `githubassets[.]net`. Separate scam-gambling networks use polished gaming and wagering sites promoted through Discord and social media, often advertising fraudulent $2,500 celebrity-linked credits. Victims can place simulated bets and see fabricated winnings, but withdrawals trigger demands for cryptocurrency “verification deposits” and further payments that never result in a payout. Researchers linked at least 1,270 recently registered domains to one centrally managed operation through shared code, tracking, support infrastructure, and chatbot credentials; affiliates have also expanded this scalable scam model. Organizations should treat casino or adult-domain DNS activity as a potential security signal rather than solely a policy issue, especially where endpoints resolve multiple distinct PeckBirdy-related domains.
Sep 15, 2026